Privacy Policy

prorso collects as little personal data as it can while still operating reliably. It does not use your data for advertising, does not sell or rent it, and does not track you across other websites.

This policy describes the data involved when you use prorso, why it is processed, and the rights you have over it. It forms part of the Terms of Use.

prorso is a personal project operated by Ivan Jureta, who acts as the data controller for personal data processed through the service. prorso is not affiliated with or operated on behalf of any organization.

You can reach the controller at ivan@ivanjureta.com for any question or request relating to your data.

Three kinds of data are involved when you use prorso:

Data is used to provide and secure the service: to create and authenticate your account, to store and display your decision logs, to preserve their immutable history, to operate AI-assisted features when you use them, and to diagnose and fix problems.

Data is not used for advertising or profiling, and is not combined with data from third parties to build a profile of you.

Where the GDPR applies, personal data is processed on the following bases: performance of the contract (providing the service you signed up for), legitimate interests (keeping the service secure and functioning), legal obligation (where the law requires it), and consent (for anything that specifically asks for it, which you can withdraw at any time).

Where you use prorso without an account — for example the guided setup on the landing page — the basis is the steps you asked us to take before entering into a contract, together with our legitimate interest in providing the feature you invoked. You are told before you submit that AI is used to process what you type, and that you can instead sign in and use prorso without it. The processing lasts only as long as the two-hour draft.

When you use AI-assisted features, the relevant content from your log may be sent to a third-party AI provider (OpenAI) solely to generate the assessment, risks, or options you requested, and then returned to you. This processing happens only when you trigger it.

This also applies before you have an account. If you describe a decision on the landing page, that sentence is sent to OpenAI, which drafts options, reasons for and against each, and comparison criteria for you to edit. It is sent when you submit the sentence and never as you type, it is not linked to an identity, and nothing is saved to an account unless you sign in.

Which OpenAI account a request goes through decides whether its content may be used to train models. Ours is used for the guided setup on the landing page, and for the guide inside a log when the log has no key of its own — neither its organisation’s nor, on a Personal log, the owner’s own; on ours, under OpenAI’s standard API terms, content is not used to train their models. Your organisation’s own account is used for the AI features inside its logs when it has connected one, and your own key, if you add one, for your Personal logs; there, that account’s terms and settings decide, including how long OpenAI keeps a request. On ours, OpenAI keeps it for up to 30 days for abuse monitoring. AI features are never applied to your private logs unless you invoke them.

Logs are private to you and the people you invite. If you choose to publish a log or template, the content you publish — including any names or details inside it — becomes readable by anyone, including signed-out visitors.

Only publish content you are comfortable making public, and avoid including personal data about others without a basis to do so.

If you belong to an organisation in prorso, its admins can see that you are a member, your role, and the actions recorded in its action log, and they can remove you from it.

An organisation can verify that it owns an email domain, such as northwind.com. If your confirmed email address is on a domain an organisation has verified, that organisation manages your prorso account:

A managing organisation cannot read the logs of other organisations you belong to, remove you from them, or change how you sign in. Your account settings say whether your account is managed, and by which organisation. The organisation that owns your work address also controls that address and its mailbox outside prorso. If you want an account no company manages, sign up with a personal email address.

Data is shared only with the service providers needed to run prorso, under agreements that limit them to that purpose:

prorso uses only the cookies and browser storage needed to keep you signed in and to remember basic preferences. It does not use advertising or cross-site tracking cookies.

Your account and content are kept for as long as your account is active. Because prorso preserves an immutable history of each log, earlier states are retained as part of that record until the log or account is deleted.

A decision you describe on the landing page without signing in is held for at most two hours from your last edit and is then deleted automatically. If you sign in within that window it becomes a log in your account and is kept like any other content. If you do not, nothing remains.

When you request that we delete your account, your personal data and logs are removed within a reasonable period and you are notified when this is executed, except where limited information must be kept to meet legal obligations. If you request the deletion of your data and we complete it, this cannot be undone.

Reasonable technical and organizational measures are used to protect your data, including encryption in transit and access controls. No service can guarantee absolute security, but access to your content is limited to what is needed to operate prorso.

Subject to applicable law, you have the right to:

Landing-page drafts are not linked to an identity, so there is no way to look one up, correct it, or export it on request. It deletes itself within two hours, and that is the only handling it gets.

Some service providers may process data outside your country or the European Economic Area. Where that happens, appropriate safeguards — such as standard contractual clauses — are relied upon to protect your data.

prorso is not directed at children and is not intended for anyone under 16. Personal data of children is not knowingly collected; if you believe a child has provided data, please get in touch so it can be removed.

This policy may be updated from time to time. When changes are material, the updated version and its effective date will be posted here, and reasonable notice will be given where practical.

For any question or request about this policy or your data, contact ivan@ivanjureta.com. Because prorso is a personal project, correspondence is handled directly by its author.